Lab 14 — Wireless Network Configuration and Security

Mission Information

Item	Details
Lab	14
Lab Name	Wireless Network Configuration and Security
Track	CompTIA Network+
Difficulty	Intermediate
Estimated Time	120–150 minutes
Primary Role	Network Technician / Junior Network Administrator
Environment	Network+ Wireless LAN Lab
Primary Systems	NETPLUS-WLAN-AP01, NETPLUS-CLIENT01, NETPLUS-RTR01, NETPLUS-SW01
Primary Tools	Wireless AP Console, Router/Switch CLI, Windows/Linux Wireless Tools, Wireshark
Skills	Wi-Fi, SSIDs, Bands, Channels, WPA2, WPA3, PSK, 802.1X, RADIUS, Guest WLAN, VLANs, Roaming, Wireless Troubleshooting

Mission Objective: Design and configure a secure wireless LAN, connect clients, validate addressing and access, apply security controls, separate guest traffic, and troubleshoot common wireless connectivity, interference, authentication, and performance problems.

Mission Scenario

GHC Enterprise currently relies mainly on wired networking.

The organization now wants wireless connectivity for:

Employees

Mobile Devices

Laptops

Guests

The network team requests two wireless networks:

GHC-STAFF

GHC-GUEST

The design must ensure that:

Employees
      ↓
Access Internal Resources

while:

Guests
      ↓
Internet / External Access Only

The network must also use modern wireless security and avoid insecure configurations.

Your mission is to configure:

Wireless Access Point
      ↓
SSIDs
      ↓
Authentication
      ↓
Encryption
      ↓
VLAN Segmentation
      ↓
DHCP
      ↓
Routing
      ↓
Secure Wireless Connectivity

Mission Objectives

By completing this lab, you will be able to:

explain wireless LAN architecture
understand access points
understand SSIDs
understand BSS and ESS concepts
identify 2.4 GHz, 5 GHz, and 6 GHz characteristics
understand wireless channels
understand channel overlap
understand channel width
configure a wireless SSID
configure WPA2-Personal
understand WPA3-Personal
compare PSK and enterprise authentication
understand 802.1X
understand RADIUS
connect wireless clients
validate DHCP over wireless
configure guest wireless
map SSIDs to VLANs
understand wireless client isolation
understand signal strength and RSSI
understand roaming
identify rogue AP concepts
understand evil twin threats
troubleshoot authentication failures
troubleshoot poor signal
troubleshoot interference
troubleshoot DHCP and VLAN problems on WLANs

1. Build the Wireless Lab Topology

Use:

                     NETPLUS-RTR01
                          |
                          |
                     NETPLUS-SW01
                          |
                          |
                    NETPLUS-WLAN-AP01
                       /         \
                      /           \
                     /             \
              GHC-STAFF          GHC-GUEST
                 |                  |
          NETPLUS-CLIENT01      Guest Client

2. Define the Wireless Networks

Use:

SSID:
GHC-STAFF

Purpose:
Employee Wireless

and:

SSID:
GHC-GUEST

Purpose:
Guest Wireless

3. Define the VLAN Design

Use:

SSID	VLAN	Network	Gateway
GHC-STAFF	10	`10.10.10.0/24`	`10.10.10.1`
GHC-GUEST	40	`10.10.40.0/24`	`10.10.40.1`

This aligns wireless traffic with the VLAN concepts from Lab 07.

4. Understand Wireless LAN Architecture

A wireless LAN typically contains:

Wireless Client
      ↓
Access Point
      ↓
Wired Ethernet Network
      ↓
Switch
      ↓
Router / Services

The access point bridges wireless clients into the wired network.

5. Understand the Access Point

An:

Access Point

provides wireless network connectivity to client devices.

Typical responsibilities include:

Advertise SSID

Manage Wireless Associations

Apply WLAN Security

Bridge Wireless Traffic

Map SSID to VLAN

Support Roaming

6. Understand SSID

SSID stands for:

Service Set Identifier

It is the wireless network name users see.

Examples:

GHC-STAFF

GHC-GUEST

The SSID identifies the WLAN, but the SSID itself is not a security control.

7. Understand BSS

Basic Service Set

or:

BSS

typically represents:

One Access Point
+
Associated Wireless Clients

Conceptually:

        AP01
       / | \
      /  |  \
 Client Client Client

8. Understand BSSID

The:

BSSID

identifies a specific Basic Service Set.

It is commonly based on a wireless interface MAC address.

Do not confuse:

SSID

with:

BSSID

SSID:

Wireless Network Name

BSSID:

Specific AP Radio / BSS Identifier

9. Understand ESS

An:

Extended Service Set

or:

ESS

allows multiple APs to provide the same logical wireless network.

Example:

AP01              AP02
 |                 |
GHC-STAFF        GHC-STAFF
       \          /
        \        /
         Client Roaming

This supports broader coverage.

10. Understand Wi-Fi Frequency Bands

Modern WLANs commonly operate in:

2.4 GHz

5 GHz

6 GHz

Each band has different characteristics.

11. Understand 2.4 GHz

2.4 GHz generally provides:

Longer Range

Better Wall Penetration

but has:

Fewer Non-Overlapping Channels

More Interference

More Competing Devices

Common interference sources include:

Bluetooth

Microwave Ovens

Other Wi-Fi Networks

IoT Devices

12. Understand 5 GHz

5 GHz generally offers:

More Channels

Higher Capacity

Less 2.4 GHz Congestion

but often:

Shorter Range

Reduced Wall Penetration

compared with 2.4 GHz.

13. Understand 6 GHz

6 GHz is associated with newer Wi-Fi generations and provides additional spectrum.

Benefits can include:

More Available Channels

Reduced Legacy Interference

Higher Capacity

Coverage characteristics depend on environment and device support.

14. Compare Wireless Bands

Feature	2.4 GHz	5 GHz	6 GHz
Range	Higher	Moderate	Generally lower
Congestion	Higher	Lower	Lower
Channel availability	Lower	Higher	Higher
Legacy support	Very high	High	Newer devices
Wall penetration	Better	Moderate	Generally lower

15. Understand Wireless Channels

Wireless networks divide frequency spectrum into:

Channels

Nearby APs using overlapping channels can interfere with one another.

16. 2.4 GHz Channel Planning

A common simplified channel plan in many regulatory domains is:

because these are commonly treated as non-overlapping 20 MHz channels.

Always follow local regulatory requirements and device capabilities.

17. Understand Co-Channel Interference

If nearby APs use the same channel:

AP01
Channel 6

AP02
Channel 6

they share airtime.

This is:

Co-Channel Interference

It may reduce performance even when the network remains functional.

18. Understand Adjacent-Channel Interference

If APs use overlapping channels:

AP01
Channel 4

AP02
Channel 6

signals can interfere more severely.

This is:

Adjacent-Channel Interference

19. Understand Channel Width

Wi-Fi may use channel widths such as:

20 MHz

40 MHz

80 MHz

160 MHz

Wider channels can increase throughput potential but consume more spectrum.

In dense environments:

Wider
≠
Always Better

20. Understand Wireless Standards

At Network+ level, be familiar with Wi-Fi generations and the IEEE 802.11 family.

Examples include:

802.11n

802.11ac

802.11ax

commonly associated with:

Wi-Fi 4

Wi-Fi 5

Wi-Fi 6

Newer variants may extend capabilities into 6 GHz.

21. Connect AP01 to the Switch

Connect:

NETPLUS-WLAN-AP01

to:

NETPLUS-SW01

The switch port may need to carry:

VLAN 10

VLAN 40

because AP01 will host both STAFF and GUEST SSIDs.

22. Configure the AP Switch Port as a Trunk

Cisco-like example:

configure terminal

interface <ap-port>
 switchport mode trunk
 switchport trunk allowed vlan 10,40
 no shutdown

23. Verify the Trunk

Run:

show interfaces trunk

Confirm:

VLAN 10
VLAN 40

are allowed.

24. Understand SSID-to-VLAN Mapping

The AP should map:

GHC-STAFF
      ↓
VLAN 10

and:

GHC-GUEST
      ↓
VLAN 40

This means the wireless network name determines which wired VLAN the client’s traffic enters.

25. Configure VLAN 10 Gateway

Ensure:

10.10.10.1

is available as the gateway for STAFF clients.

26. Configure VLAN 40 Gateway

Ensure:

10.10.40.1

is available as the gateway for GUEST clients.

Use router subinterfaces or Layer 3 SVIs according to your existing lab topology.

27. Configure DHCP for STAFF

Provide:

Network:
10.10.10.0/24

Pool:
10.10.10.100–10.10.10.200

Gateway:
10.10.10.1

DNS:
<lab DNS server>

28. Configure DHCP for GUEST

Provide:

Network:
10.10.40.0/24

Pool:
10.10.40.100–10.10.40.200

Gateway:
10.10.40.1

DNS:
<approved DNS server>

29. Configure the STAFF SSID

On AP01 create:

SSID:
GHC-STAFF

Map it to:

VLAN 10

30. Choose the STAFF Wireless Band

For the lab, enable:

5 GHz

if supported.

You may also enable:

2.4 GHz

to compare behavior.

31. Configure Channel Selection

Use either:

Automatic Channel Selection

or select a safe lab channel manually.

For example:

2.4 GHz:
Channel 1

5 GHz:
Approved available channel

Exact channels vary by regulatory region and equipment.

32. Understand WLAN Security Modes

Common historical and modern modes include:

Open

WEP

WPA

WPA2

WPA3

Avoid:

WEP

and legacy WPA configurations.

33. Understand WPA2

WPA2 commonly uses:

AES-based CCMP

for secure wireless communication.

For a small WLAN, you may use:

WPA2-Personal

with a:

Pre-Shared Key

34. Understand WPA3

WPA3 improves wireless security over WPA2.

WPA3-Personal uses:

SAE

instead of the traditional WPA2-Personal PSK authentication exchange.

Use WPA3 where supported by all required clients and infrastructure.

35. Configure STAFF Security

For this lab, configure either:

WPA2-Personal

or:

WPA3-Personal

depending on AP/client capabilities.

Use a strong lab passphrase.

Example format:

GHC-Lab-WLAN-2026!

Do not reuse real credentials.

36. Understand PSK

PSK means:

Pre-Shared Key

The same wireless secret is shared among authorized users/devices.

This works well for:

Home Networks

Small Offices

Labs

but becomes harder to manage in large enterprise networks.

37. Connect CLIENT01 to STAFF

On CLIENT01, view available WLANs.

Windows:

netsh wlan show networks

Locate:

GHC-STAFF

Connect using the configured lab credentials.

38. Verify Wireless Interface

Run:

netsh wlan show interfaces

Record:

SSID:

BSSID:

Signal:

Radio Type:

Channel:

Receive Rate:

Transmit Rate:

39. Verify DHCP Address

Run:

ipconfig /all

CLIENT01 should receive:

10.10.10.x

because:

GHC-STAFF
      ↓
VLAN 10

40. Verify Gateway Connectivity

Run:

ping 10.10.10.1

Expected:

Success

41. Verify DNS

Run:

nslookup server01.gohackerscloud.lab

if the DNS lab remains configured.

42. Verify Internal Resource Access

Test:

ping 10.10.10.30

or another approved internal resource.

This validates:

Wireless Client
      ↓
SSID
      ↓
VLAN
      ↓
DHCP
      ↓
Routing
      ↓
Internal Resource

43. Configure the GUEST SSID

Create:

SSID:
GHC-GUEST

Map to:

VLAN 40

44. Configure Guest Security

Depending on lab goals, configure:

WPA2/WPA3-Personal

with a separate guest passphrase.

Do not reuse the STAFF key.

Example:

GHC-Guest-Lab-2026!

45. Connect a Guest Client

Connect a second wireless client to:

GHC-GUEST

Verify it receives:

10.10.40.x

46. Verify Guest Gateway

The guest client should use:

10.10.40.1

as its gateway.

47. Validate VLAN Separation

STAFF client:

10.10.10.x

Guest client:

10.10.40.x

This confirms:

Different SSIDs
      ↓
Different VLANs
      ↓
Different IP Networks

48. Restrict Guest Access

Guest clients should not have unrestricted access to internal networks.

Conceptually implement:

GUEST VLAN
      ↓
Block Internal RFC1918 / Corporate Networks
      ↓
Allow Required External Services

Use an ACL or firewall according to your lab topology.

49. Test Guest Isolation from STAFF

From GUEST client, attempt:

ping 10.10.10.20

Expected:

Blocked

if policy is configured.

50. Test Guest External Connectivity

If the lab has a safe external test network, verify the guest client can reach it.

Expected:

Guest
      ↓
Gateway
      ↓
NAT / Routing
      ↓
External Network

51. Understand Client Isolation

Wireless APs may support:

Client Isolation

or:

AP Isolation

This prevents wireless clients on the same SSID from communicating directly with one another.

Useful for:

Guest Networks

Public Wi-Fi

52. Enable Guest Client Isolation

Where supported, enable isolation on:

GHC-GUEST

Connect two guest clients.

Test client-to-client communication.

Expected:

Guest Client A
      X
Guest Client B

depending on implementation.

53. Understand Signal Strength

Wireless quality depends heavily on:

Signal Strength

Common measurements include:

RSSI

and values represented in:

dBm

54. Understand dBm

Wireless signal strength is often represented using negative numbers.

Conceptually:

-40 dBm
Very Strong

-60 dBm
Good

-70 dBm
Weaker

-80 dBm
Poor / Unreliable

Exact acceptable values depend on application and environment.

Remember:

Closer to Zero
=
Stronger Signal

55. Check Windows Wireless Signal

Run:

netsh wlan show interfaces

Record:

Signal:
<percentage>

Some wireless tools provide more detailed RSSI values.

56. Understand SNR

SNR means:

Signal-to-Noise Ratio

It compares:

Desired Wireless Signal

against:

Background Noise

Higher SNR generally means better wireless quality.

57. Understand Interference

Wireless interference can result from:

Nearby APs

Bluetooth

Microwave Ovens

Cordless Devices

IoT Equipment

Physical Obstacles

Symptoms can include:

Low Throughput

High Retransmissions

Disconnections

High Latency

58. Perform a Wireless Survey

Using AP or client tools, record:

SSID

BSSID

Band

Channel

Signal Strength

Security Mode

for nearby lab WLANs.

Do not collect or analyze unrelated private network traffic.

59. Build a Wireless Survey Table

SSID	Band	Channel	Signal	Security
GHC-STAFF	5 GHz	`<channel>`	`<signal>`	WPA2/WPA3
GHC-GUEST	5 GHz	`<channel>`	`<signal>`	WPA2/WPA3

60. Troubleshooting Scenario 1 — Wrong Password

Change or intentionally enter an incorrect STAFF passphrase.

Expected:

SSID Visible
      ↓
Connection Attempt
      ↓
Authentication Failure

61. Diagnose Wrong Wireless Credentials

Check:

Correct SSID?

Correct Security Mode?

Correct Passphrase?

Saved Profile Stale?

The presence of the SSID proves only that the AP is advertising.

62. Remove a Saved Windows WLAN Profile

If needed:

netsh wlan delete profile name="GHC-STAFF"

Reconnect with the correct settings.

63. Troubleshooting Scenario 2 — SSID Not Visible

Disable SSID broadcasting or the WLAN temporarily.

The client may no longer see:

GHC-STAFF

Investigate:

AP Powered On?

WLAN Enabled?

SSID Configured?

Radio Enabled?

Supported Band?

Client Radio Enabled?

64. Hidden SSIDs

Disabling SSID advertisement does not provide strong wireless security.

A hidden SSID should not be treated as a substitute for:

WPA2/WPA3

Strong Authentication

65. Troubleshooting Scenario 3 — Unsupported Band

Configure STAFF as:

6 GHz Only

while using a client that supports only:

2.4 / 5 GHz

Expected:

Client Cannot Discover / Join WLAN

Root cause:

Radio Capability Mismatch

66. Troubleshooting Scenario 4 — Weak Signal

Move the client farther away from AP01 or reduce lab radio power where supported.

Observe:

Signal Strength Decreases

Potential symptoms:

Lower Throughput

Higher Latency

Packet Loss

Disconnection

67. Diagnose Weak Signal

Investigate:

Distance

Walls

Metal Objects

AP Placement

Transmit Power

Antenna Orientation

Interference

68. Troubleshooting Scenario 5 — Channel Interference

Configure two nearby lab AP radios onto the same or overlapping 2.4 GHz channels.

Observe performance.

Compare with a planned channel layout.

The goal is to understand:

Channel Planning
      ↓
Less Interference
      ↓
Better Airtime Efficiency

69. Troubleshooting Scenario 6 — WLAN Connected but No IP

CLIENT01 successfully joins:

GHC-STAFF

but receives:

169.254.x.x

This indicates:

Wireless Association:
Working

DHCP:
Failing

70. Diagnose WLAN DHCP Failure

Check:

SSID-to-VLAN Mapping

AP Trunk

VLAN Allowed?

DHCP Scope?

DHCP Relay?

DHCP Server Reachable?

This demonstrates why wireless troubleshooting must extend beyond radio connectivity.

71. Troubleshooting Scenario 7 — Wrong VLAN Mapping

Map:

GHC-STAFF

accidentally to:

VLAN 40

CLIENT01 may receive:

10.10.40.x

instead of:

10.10.10.x

72. Diagnose Wrong SSID VLAN

Check:

SSID:
GHC-STAFF

Mapped VLAN:
40

Expected:

Correct the AP WLAN mapping.

73. Troubleshooting Scenario 8 — VLAN Missing on AP Trunk

Remove:

VLAN 40

from the switch trunk toward AP01.

STAFF may still work.

GUEST may fail.

This gives a useful symptom:

One SSID Works

One SSID Fails

74. Diagnose Missing Trunk VLAN

Check:

show interfaces trunk

Verify:

VLAN 10:
Allowed

VLAN 40:
Missing

Restore VLAN 40.

75. Troubleshooting Scenario 9 — Wrong Guest Gateway

DHCP gives guest clients:

Gateway:
10.10.10.1

instead of:

10.10.40.1

Guest clients may communicate locally but fail to route correctly.

Correct the DHCP scope option.

76. Troubleshooting Scenario 10 — DNS Failure over WLAN

Wireless connectivity works.

Gateway ping works.

IP-based access works.

Hostname resolution fails.

Check:

DHCP DNS Option

DNS Server Reachability

DNS Service

Firewall

The wireless layer may be healthy.

77. Understand Wireless Roaming

In an ESS, a client may move between APs that advertise the same SSID.

Conceptually:

AP01
GHC-STAFF
      ↓
Client Moves
      ↓
AP02
GHC-STAFF

This is:

Roaming

78. Build a Two-AP Roaming Lab

Add:

NETPLUS-WLAN-AP02

Configure:

SSID:
GHC-STAFF

with compatible security and VLAN settings.

Use a different appropriate channel.

79. Why Different Channels Matter

Adjacent APs should generally avoid unnecessary channel overlap.

Example:

AP01
Channel 1

AP02
Channel 6

for a simplified 2.4 GHz deployment.

80. Test Roaming

Move the client logically or physically between coverage areas.

Observe the client’s:

BSSID

before and after.

The:

SSID

may remain:

GHC-STAFF

while the:

BSSID

changes.

81. Understand Roaming Decision

In many WLANs, the:

Client

plays a major role in deciding when to roam.

Factors can include:

Signal Strength

Driver Behavior

AP Capability

Roaming Assistance Features

82. Understand 802.1X

Enterprise WLANs may use:

802.1X

for centralized authentication.

Conceptually:

Wireless Client
      ↓
Access Point
      ↓
RADIUS Server
      ↓
Identity Validation

83. Understand the 802.1X Roles

Common terminology:

Supplicant
=
Client

Authenticator
=
Access Point / Switch

Authentication Server
=
RADIUS Server

84. Understand RADIUS

RADIUS provides centralized:

Authentication

Authorization

Accounting

often remembered as:

AAA

85. WPA2/WPA3 Enterprise

Enterprise wireless security can use:

WPA2-Enterprise

or:

WPA3-Enterprise

with:

802.1X
+
RADIUS

instead of one shared PSK.

86. Compare Personal and Enterprise WLAN Security

Feature	Personal	Enterprise
Authentication	Shared secret	Individual identity
Backend	None required	RADIUS/AAA
User revocation	Change PSK or device-specific mechanisms	Disable identity
Scalability	Small networks	Enterprise
Accountability	Lower	Higher

87. Enterprise Authentication Flow

Conceptually:

CLIENT
   ↓
Join GHC-STAFF
   ↓
AP requests authentication
   ↓
802.1X exchange
   ↓
RADIUS
   ↓
Identity validated
   ↓
Network access granted

88. Understand EAP

802.1X commonly uses:

EAP

or:

Extensible Authentication Protocol

Different EAP methods provide different authentication approaches.

For Network+, understand the role of EAP rather than implementing every method.

89. Understand Rogue Access Points

Rogue Access Point

is an unauthorized AP connected to or operating within an organization’s environment.

Examples:

Employee Installs Personal AP

Unauthorized Wireless Router

Misconfigured Device

Possible risks include:

Security Policy Bypass

Unauthorized Network Access

Traffic Exposure

90. Understand Evil Twin

An:

Evil Twin

is a malicious or unauthorized wireless network designed to imitate a legitimate WLAN.

Example:

Legitimate:
GHC-STAFF

Malicious:
GHC-STAFF

Users may connect to the wrong AP.

91. Defensive Wireless Validation

When investigating suspicious wireless networks, compare:

SSID

BSSID

Security Mode

Channel

Signal Characteristics

Authorized AP Inventory

Do not assume identical SSID means identical infrastructure.

92. Understand Deauthentication Attacks Conceptually

Wireless management frames can be abused in some environments to disrupt client connectivity.

Modern protections such as:

Protected Management Frames

can reduce certain management-frame attacks.

This lab focuses on defensive awareness, not performing disruptive attacks.

93. Understand Protected Management Frames

PMF helps protect certain wireless management communications.

It is associated with modern Wi-Fi security and is important in WPA3 deployments.

94. Understand Captive Portals

Guest WLANs may use a:

Captive Portal

to present:

Terms of Use

Login Page

Guest Registration

before allowing external access.

A captive portal is not a substitute for proper wireless encryption and segmentation.

95. Understand AP Placement

Poor AP placement can create:

Coverage Gaps

Dead Zones

Excessive Overlap

Interference

Better design considers:

Building Layout

User Density

Walls

Interference

Capacity

Roaming

96. Coverage vs Capacity

Wireless design must consider both:

Can the client hear the AP?

and:

Can the AP handle the number of clients?

Good signal does not automatically mean good performance.

97. Understand Airtime

Wireless is a shared medium.

Clients attached to the same radio compete for:

Airtime

A slow or distant client may consume more airtime for the same amount of data.

98. Wireless Troubleshooting Methodology

Use:

Is Wireless Adapter Enabled?
      ↓
Can Client See SSID?
      ↓
Does Client Support Band?
      ↓
Correct Security Mode?
      ↓
Correct Credentials?
      ↓
Association Successful?
      ↓
Correct VLAN?
      ↓
DHCP Lease Obtained?
      ↓
Correct Gateway?
      ↓
DNS Working?
      ↓
Signal Strong Enough?
      ↓
Channel Interference?
      ↓
Routing / Firewall Correct?
      ↓
Application Working?

99. Mission Challenge — Identify the Band

Requirement:

Maximum compatibility
+
Longer indoor reach

Likely preference:

2.4 GHz

with the tradeoff of more congestion.

100. Mission Challenge — Higher Capacity

Requirement:

More channels
+
Less 2.4 GHz congestion

Likely preference:

5 GHz

or 6 GHz where appropriate and supported.

101. Mission Challenge — Wrong IP Network

Client joins:

GHC-STAFF

but receives:

10.10.40.120

Expected:

10.10.10.x

First investigate:

SSID-to-VLAN Mapping

102. Mission Challenge — AP Visible but Connection Fails

Symptoms:

SSID Visible

Strong Signal

Authentication Failure

Investigate:

Passphrase

Security Mode

Client Compatibility

Saved Profile

103. Mission Challenge — Client Connected but APIPA

Client shows:

Connected to GHC-STAFF

but:

169.254.35.10

Investigate:

VLAN

DHCP

Trunk

Relay

not the wireless password.

104. Mission Challenge — Guest Reaches Internal Server

Guest client:

10.10.40.120

can reach:

10.10.10.30

but policy says guests must not access internal resources.

The wireless association is working.

The problem is:

Segmentation / Firewall / ACL Policy

105. Mission Challenge — Same SSID, Different AP

Client originally connected to:

SSID:
GHC-STAFF

BSSID:
AA:AA:AA:AA:AA:01

Later:

SSID:
GHC-STAFF

BSSID:
AA:AA:AA:AA:AA:02

This can indicate:

Client Roamed to Another AP

106. Mission Challenge — Rogue WLAN

Authorized AP inventory contains:

GHC-STAFF
BSSID:
AA:AA:AA:AA:AA:01

but a nearby WLAN appears as:

GHC-STAFF
BSSID:
BB:BB:BB:BB:BB:99

Investigate as:

Potential Rogue / Evil Twin

rather than trusting the SSID name alone.

107. Create the Lab Workspace

On NETPLUS-ADMIN:

mkdir -p ~/NetworkPlus-Labs/LAB14/{Captures,Screenshots,Configs,Notes}

Create:

touch ~/NetworkPlus-Labs/LAB14/Notes/lab14-notes.md

108. Save Wireless Configuration Evidence

Document:

AP Name

SSID

BSSID

Band

Channel

Channel Width

Security Mode

VLAN Mapping

Guest Isolation

Transmit Power

Store under:

~/NetworkPlus-Labs/LAB14/Configs/

109. Document Your Findings

Use:

# LAB14 — Wireless Network Configuration and Security

## Wireless Infrastructure

AP:
NETPLUS-WLAN-AP01

Management IP:

Switch Port:

Trunk VLANs:

## STAFF WLAN

SSID:
GHC-STAFF

VLAN:
10

Network:
10.10.10.0/24

Gateway:
10.10.10.1

Security:

Band:

Channel:

Channel Width:

## GUEST WLAN

SSID:
GHC-GUEST

VLAN:
40

Network:
10.10.40.0/24

Gateway:
10.10.40.1

Security:

Client Isolation:
Enabled / Disabled

## STAFF Client

IP:

Gateway:

DNS:

SSID:

BSSID:

Signal:

Channel:

## Guest Client

IP:

Gateway:

DNS:

SSID:

BSSID:

Internal Access:
Allowed / Blocked

External Access:
Pass / Fail

## Wireless Survey

SSID:

BSSID:

Band:

Channel:

Signal:

Security:

## Troubleshooting

### Wrong Passphrase

Symptom:

Root Cause:

Fix:

### SSID Not Visible

Symptom:

Root Cause:

Fix:

### Weak Signal

Symptom:

Root Cause:

Fix:

### DHCP Failure

Symptom:

Root Cause:

Fix:

### Wrong VLAN

Symptom:

Root Cause:

Fix:

### Missing Trunk VLAN

Symptom:

Root Cause:

Fix:

### DNS Failure

Symptom:

Root Cause:

Fix:

## Roaming

Original AP/BSSID:

New AP/BSSID:

SSID:

Connectivity Impact:

## Security Assessment

PSK / Enterprise:

Guest Segmentation:

Client Isolation:

Rogue AP Findings:

## Final Assessment

Summarize how the WLAN was secured, segmented, validated, and troubleshot.

110. Evidence to Capture

Capture:

01-wireless-topology.png

02-ap-switch-trunk.png

03-staff-ssid-config.png

04-staff-security-config.png

05-staff-vlan-mapping.png

06-guest-ssid-config.png

07-guest-security-config.png

08-guest-vlan-mapping.png

09-client-visible-networks.png

10-client-staff-connection.png

11-wireless-interface-details.png

12-staff-dhcp-lease.png

13-staff-gateway-test.png

14-staff-internal-access.png

15-guest-dhcp-lease.png

16-guest-gateway-test.png

17-guest-internal-block.png

18-guest-external-access.png

19-client-isolation.png

20-wireless-survey.png

21-channel-information.png

22-signal-strength.png

23-wrong-password.png

24-hidden-ssid.png

25-band-mismatch.png

26-weak-signal.png

27-channel-interference.png

28-wireless-apipa.png

29-wrong-ssid-vlan.png

30-missing-ap-trunk-vlan.png

31-wrong-guest-gateway.png

32-wireless-dns-failure.png

33-ap02-roaming.png

34-bssid-change.png

35-enterprise-authentication-diagram.png

36-final-wireless-topology.png

111. Validation Checklist

Infrastructure

AP01 connected to switch
AP switch port configured correctly
VLAN 10 allowed
VLAN 40 allowed
VLAN gateways available
DHCP scopes available

Wireless Fundamentals

AP role understood
SSID understood
BSS understood
BSSID understood
ESS understood
2.4 GHz understood
5 GHz understood
6 GHz understood
Channel concepts understood
Channel width understood

STAFF WLAN

GHC-STAFF created
VLAN 10 mapped
WPA2/WPA3 configured
STAFF client connected
Correct DHCP lease received
Gateway verified
DNS verified
Internal resource access verified

GUEST WLAN

GHC-GUEST created
VLAN 40 mapped
Separate credentials configured
Guest client connected
Correct DHCP lease received
Guest gateway verified
Internal access restricted
External access verified where available
Client isolation tested

Wireless Security

WEP recognized as insecure
WPA2 understood
WPA3 understood
PSK understood
Personal vs Enterprise compared
802.1X understood
RADIUS understood
EAP understood conceptually
Rogue AP concept understood
Evil twin concept understood
PMF concept understood

Wireless Performance

Signal strength reviewed
RSSI concept understood
dBm understood
SNR understood
Interference understood
Channel planning understood
Co-channel interference understood
Adjacent-channel interference understood
Coverage vs capacity understood
Airtime understood

Roaming

AP02 configured where supported
Same SSID configured
Different appropriate channel used
Client roaming observed
BSSID change identified

Troubleshooting

Wrong passphrase investigated
SSID-not-visible scenario investigated
Band incompatibility understood
Weak-signal scenario investigated
Interference scenario investigated
Wireless APIPA scenario investigated
Wrong VLAN mapping investigated
Missing trunk VLAN investigated
Wrong gateway investigated
DNS failure distinguished from wireless failure
Guest policy failure investigated

Documentation

Wireless topology documented
SSIDs documented
VLAN mappings documented
Security modes documented
Survey results recorded
Troubleshooting findings documented
Screenshots captured
Lab notes completed

112. Mission Review

In this mission, you extended the enterprise network from:

Wired Ethernet

to:

Wired
+
Wireless

The STAFF connection flow became:

Wireless Client
      ↓
GHC-STAFF
      ↓
WPA2 / WPA3 Authentication
      ↓
AP01
      ↓
VLAN 10
      ↓
DHCP
      ↓
10.10.10.x
      ↓
Gateway
      ↓
Internal / External Network

The GUEST workflow became:

Guest Client
      ↓
GHC-GUEST
      ↓
VLAN 40
      ↓
10.10.40.x
      ↓
Guest Security Policy
      ├── X Internal Network
      └── External Access

You also learned that a successful wireless connection depends on multiple layers:

Radio
      ↓
SSID
      ↓
Authentication
      ↓
Association
      ↓
VLAN
      ↓
DHCP
      ↓
Routing
      ↓
DNS
      ↓
Firewall
      ↓
Application

The key lesson is:

Wireless troubleshooting should not stop at signal strength. A client must successfully discover the WLAN, authenticate, associate, enter the correct VLAN, receive valid IP configuration, reach its gateway, resolve names, and pass the required network security policies.

Skills Developed

After completing this mission, you should be able to:

explain wireless LAN architecture
distinguish SSID and BSSID
explain BSS and ESS
compare 2.4 GHz, 5 GHz, and 6 GHz
explain channel planning
understand channel width
identify wireless interference
configure wireless SSIDs
configure WPA2/WPA3 security
understand PSK authentication
explain enterprise wireless authentication
explain 802.1X and RADIUS
map WLANs to VLANs
configure guest wireless segmentation
understand client isolation
validate wireless DHCP
interpret wireless client status
understand RSSI and dBm
understand roaming
recognize rogue APs
recognize evil twin concepts
troubleshoot authentication failures
troubleshoot weak signal
troubleshoot WLAN VLAN problems
troubleshoot DHCP and DNS over wireless

What’s Next?

Lab 15 — Network Services and Common Protocol Investigation

You have now built:

Switching
      ↓
VLANs
      ↓
Routing
      ↓
DHCP
      ↓
DNS
      ↓
NAT
      ↓
Wireless

The next mission focuses on the network services that run across this infrastructure.

You will investigate:

TCP and UDP
well-known ports
HTTP and HTTPS
SSH
FTP and SFTP
SMTP
DNS
DHCP
NTP
SNMP
SMB
RDP
LDAP and LDAPS
service listeners
TCP handshakes
port connectivity
protocol identification
encrypted vs unencrypted services
packet analysis
service troubleshooting

The progression becomes:

Network Infrastructure
      ↓
IP Connectivity
      ↓
Transport Protocol
      ↓
TCP / UDP Port
      ↓
Network Service
      ↓
Application

➡️ Next: Lab 15 — Network Services and Common Protocol Investigation